Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b2d83828264fca58e72543d48cc7a50.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b2d83828264fca58e72543d48cc7a50.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 0b2d83828264fca58e72543d48cc7a50.exe
- Size 4.1MB
- Sample240530-bt375she31
- SHA256 ca13a9f77f0a993574e8a1bb74724d0b6524812967dfc099847879d59ef2e802
- MD5 0b2d83828264fca58e72543d48cc7a50
- SHA1 38965361abba5c323f774afa85f42c5e6bfc58f8
- SHA512 785a12a1d7243e60c1dff217c9ec955862fe637ab01a98d00b16acb4ff53d90f72d40aeed728b5bb9c758e10330ade8e4151e15c7b6795854c0792dfc17cba86
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm85n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4996 adobloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot7S\\adobloc.exe" 0b2d83828264fca58e72543d48cc7a50.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintXA\\optidevsys.exe" 0b2d83828264fca58e72543d48cc7a50.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 4996 adobloc.exe 4996 adobloc.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe 2976 0b2d83828264fca58e72543d48cc7a50.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4996 2976 0b2d83828264fca58e72543d48cc7a50.exe 86 PID 2976 wrote to memory of 4996 2976 0b2d83828264fca58e72543d48cc7a50.exe 86 PID 2976 wrote to memory of 4996 2976 0b2d83828264fca58e72543d48cc7a50.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b2d83828264fca58e72543d48cc7a50.exe"C:\Users\Admin\AppData\Local\Temp\0b2d83828264fca58e72543d48cc7a50.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\UserDot7S\adobloc.exeC:\UserDot7S\adobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintXA\optidevsys.exe
- Size 4.1MB
- SHA256 3c59a5e2959369cc43bb60cd84705630afbda28908d56efa2eda27ae645ae900
- MD5 32d85f5ca1ae13368d38b98aa7bff788
- SHA1 26361f97e7e717ef9624fadb20cc1923185cd0aa
- SHA512 16d1734dfdc1870abf7200ee82d5721e8509d112df53812cb99c2cb41708b18be447da6a41b29eda89de16d33f2f17121194b084fbbfb27ba5be62c02f581451
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpP4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmw5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot7S\adobloc.exe
- Size 4.1MB
- SHA256 da03257b4cc595d6661f93e301981975dd505156c7a349d488ba81ca44cf5bc9
- MD5 6465d7238ab6759d513180880938f7d9
- SHA1 06d35c2fd1a1c2769207d8ab611895cde7ff60e6
- SHA512 b33252964640442a8116584c8fcc226b75a0a6d12ba0f9cf1dea1361e355debd12f08858b2db3fd9842ceb1446d40694ac8ae088469ebcdc2cd68c5b536afaa3
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp24ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmp5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 47662af59f700a5d9cfc44ff313ea811a03e7781e7bdb1331f18c7bc6607d00b
- MD5 0dde0a900a264bf2cece6a0b8d57d36a
- SHA1 9b15c30386ad838d6db7243ce4e80c37d9b1a3e7
- SHA512 ac9e6590c6e2106f642e3aba7d8ad79101fc2f327b97f6081cc4bdf7180a65831298e5288d4422303c8c16fcd41fd32b973b383e141b8671eaa5c4ee5e98995d
- MD5 SHA1 SHA512